v0.25.0

0.25.0 (2026-09-30)

Features

• audit: append-only destructive-op audit log (0e51f8b)
• builder: net mode for builder VMs + restricted-host script (S9b-8) (930d15f)
• ch: auto-select vhost-user when tap is blocked (S9b-10) (fb668e9)
• ch: default new sandboxes to vhost-user net mode (S9b-11) (3f732e9)
• ch: record net mode per sandbox, stop reading env at start (S9b-1) (4fcd445)
• ch: S9b-1 record net mode per sandbox, stop reading env at start (1a39c3f)
• ch: snapshot/restore/fork parity for vhost-user (S9b-6) (765d942)
• ch: vhost-user net in empty-netns child (S9b-3) (f22a7d3)
• controller: agent front door P1 (in progress) (e960898)
• controller: blocked question format, Esc-then-Prompt reply (71c0ce6)
• controller: default agents to bypassPermissions (9a69e94)
• controller: model configurable per channel via Deps.Model (3d0b68c)
• controller: per-channel model field and ModelFromConfig (f7aa98d)
• controller: turn marker + session-id transcript answer extraction (f15eefb)
• controller: wire nexus-controller serve to real adapters (dfeb3c4)
• delegate: report herdr agent state; confirm delivery (9939acd)
• diskfloor: env override for disk floor and herdr volume sizes (dcd9722)
• doctor: add required userns_net AppArmor check (Z8a) (11b4efa)
• doctor: split checks into required/optional groups (Z8a) (a5d1a08)
• doctor: Z8a required/optional groups + userns_net AppArmor check (29a9f29)
• herdragent: ExtractQuestion strips hook noise, last 30 lines (599260a)
• herdragent: herdr native agent-state seam (19a7ab2)
• herdr: auto-bind repo-scoped GitHub token for linked users (6cede41)
• herdr: global prune guard against foreign herdr sessions (b9dfee7)
• hostbin: embed guest nexus-agent built from this tree (Z2b) (c374c31)
• hostbin: embed pinned host binaries with make artifacts (229c383)
• hostbin: embed static e2fsprogs 1.47.2, drop host dep (Z3) (d994fa5)
• hostbin: resolve cloud-hypervisor via embedded artifact (Z2) (8dc269b)
• hostbin: virtiofsd via hostbin; re-exec for file mounts (Z4) (f49439a)
• kernel: pin vmlinux v0.24.0 and auto-fetch on first create (Z5) (be6175a)
• recovery: report legacy tap VMs as indeterminate (93149a4)
• sandbox: inject host-verified gh CLI into sandboxes (92ef3b9)
• service: audit-log every sandbox removal (70461c5)
• service: refuse tap snapshots and legacy-NIC snapshot/fork (f4175c0)
• supervisor: launch in own systemd user scope (8d2f005)
• supervisor: mode-aware adopt/reacquire for vhost-user (S9b-5) (fa9efce)
• supervisor: refuse legacy NIC on upgrade/adopt/reacquire (887278d)
• vault: ship registered GitHub App client ID (962f55c)
• vault: wire vault into create, supervisor, MCP and MITM 401 (4891a97)
• vhostnet: pure-Go vhost-user-net slave with tests (S9b-2) (14630a2)
• volume: add volume restore and ls --trash (5a5eeaa)
• volume: seed worktree volumes from per-project warm copies (1d2b3b2)
• volumestore: audit-log volume rm, trash, restore and expiry (b62ce12)
• volumestore: trash, restore and expiry for named volumes (295debd)
• z9a: vhost-user net config + shared memory + no-net mode (7e6e78e)

Bug Fixes

• add nolint reasons for intended error drops (b6f051d)
• agentcfg: product-mount plugin cache, never truncate linked dst (36bec48)
• agentcfg: rebind plugin cache after overlay; real hardlink test (ee0ccc7)
• agentcfg: rebind plugin cache on restart; non-fatal rebind (d44cea2)
• backend: shared sandboxhandle pkg, early rollback on provision fail (ebaf0df)
• ch: gate Shared memory on LiveMounts or vhost-user net only (681b92b)
• ch: re-probe tap when userns sysctl changes (S9b-10b) (cb3ca21)
• ch: tie virtiofsd lifetime to VM, not supervisor (B1) (3015733)
• cli: capture sandbox create stderr in worktree-sandbox error (b66bee0)
• cli: guard supervisor-upgrade and warn in recover for legacy virtiofsd (B1) (1c2aab2)
• cli: promote warm volumes on rm; lease agentcfg stage dir (236f71b)
• cli: stop falls back to driver when supervisor is dead (710e151)
• controller: detect permission dialog on idle via screen read (3aefab9)
• controller: deterministic sessionID, persisted turnID, drop legacy (e0054b6)
• controller: ephemeral link-flow posts; slash ref empty ts (b2e57aa)
• controller: exact-id teardown; copy mutable test images (b76c3ce)
• controller: extract answer from transcript, not pane dump (95eab66)
• controller: guest-shell, marker lifetime, per-channel perm mode (572b368)
• controller: pass channel model and perm mode on restart (6a91109)
• controller: poll github device code until approved or expired (111d6fe)
• controller: post user-actionable failure reason in thread (735845b)
• controller: recover empty wsID binding on restart and teardown (edbd068)
• controller: recover stuck threads and add provisioning ack (4a2d284)
• controller: resolve recovery pane via herdr pane list (2f5ec2a)
• controller: revive threads, owner checks, idle wiring (8a79b59)
• controller: rollback, env filter, exact parse, unknown observe (da83daf)
• controller: sanitize agent name for uppercase workspace IDs (6cdbbeb)
• controller: shell out to nexus CLI for sandbox lifecycle (41597b4)
• controller: UUID session ID, --resume on Restart (6dba213)
• controller: verify principal, bound turns, cancellable router (8c03dc2)
• controller: wire channel repo path into herdr backend Provision (e06fe78)
• controller: wire populated connector registry into VaultLinker (a15ef3a)
• core: in-process reflink/sparse copy, drop host cp (Z8d) (a0f999a)
• doctor: check mke2fs and e2fsck on PATH (fcc9c92)
• egress: broker repo-scoped GitHub token for nexus (fb9df4e)
• herdr-backend: keep Teardown idempotent after eviction (66dd43f)
• herdr: explicit worktree-sandbox returns error on bad list/checkout (3d61964)
• herdr: parse NEXUS_BIN default in pane.sh shim (60e5a0f)
• herdr: record herdr session and worktree path on bindings (7b863dd)
• herdr: refuse global prune --apply across herdr sessions (598ba28)
• herdr: release stale agent name on restart (73ac7ef)
• herdr: remove volumes and branch on teardown and rollback (eb9b745)
• herdr: repair empty-workspace binding on restart (b302f04)
• herdr: resolve by SandboxID, guard clobber from adoption (0e9c0fe)
• herdr: scope prune workspace-exists to the binding's herdr session (a0bf483)
• herdr: session guard on prune only; rebind uses raw listing (13a863a)
• herdr: skip auto-provision for controller-claimed worktrees (39a3aa1)
• herdr: use effective principal for adopt and reuse (c7ef405)
• herdr: wire prune guard flag and trash agentcfg/nexusstate on prune (43df507)
• hostbin: pin virtiofsd v1.13.3-fakeowner; add VIRTIOFSD_DIR (Z4) (25f6fc7)
• kernel: move vmlinux to KernelPin() to skip artifact embed (ee08332)
• lifecycle: allow stop trigger from paused state (2f23579)
• livenexus: full prod isolation and supervisor-first cleanup (6be123e)
• mitm: bind host to CONNECT target; allow gh pr GraphQL (e332c86)
• mitm: match auth scheme case-insensitively (fbd4198)
• reap: sweep orphan agentcfg-lower dirs (9e425ba)
• service: dedupe mcp oauth reads and add discovery timeout (a123f6b)
• service: drop host claude share mount from guests (95efb11)
• service: resume paused VM before graceful stop (64e80e3)
• slack: deduplicate mention replies, allow file_share subtypes (5838f78)
• slack: log errors and lifecycle events; Run survives handler errors (5fa498d)
• supervisor: scope start non-blocking, remove invalid OOMScoreAdjust (3d0c526)
• supervisor: seed vault GH_TOKEN placeholder into cred.env (c3092f5)
• volume: keep larger fresh warm copies; cap and evict .warm (69aac00)
• volume: warm copy free-space floor, real ctx cancel, tmp cleanup (f01f4d9)

Performance Improvements

• agentcfg: skip live-mounted plugin cache, hardlink staged config (9233fce)